Questions tagged [tcpdump]
tcpdump is a CLI tool for capturing and displaying packets sent and received by network devices.
121
questions with no upvoted or accepted answers
4
votes
1
answer
846
views
Finding google unusual traffic
We are a small Internet provider. In order to get Internet access we are using NAT (10-20 users per one public IP). And lately we've met with Google blocking services (captcha and full block) and we ...
3
votes
0
answers
649
views
TCP retransmission inside of docker network
Just lately our server started experiencing increased CPU usage by the php(Symfony) and mysql processes. For quite some time we been trying to find the cause and we found out that we have big amount ...
3
votes
0
answers
944
views
TCP Window Scaling Not Working Between Windows 10 and Linux Server
We are having some issues with several clients running Windows 10 downloading files from our HTTP file delivery server.
We can't reproduce the error on our end but notice that TCP window scaling is ...
3
votes
0
answers
517
views
Is it possible to capture traffic on host when using KVM passthrough?
I have a KVM guest which uses PCI passthrough for its network interfaces:
<hostdev mode='subsystem' type='pci' managed='yes'>
<source>
<address domain='0x0000' bus='0x05' slot='...
3
votes
0
answers
2k
views
how to use tcpdump on interface with link down
A set of daemon applications communicating over UDP broadcasts on the same machine give me trouble capturing their traffic. The network interface is eth0, it's configured to a static IP and there's no ...
3
votes
1
answer
335
views
Suggestions on how to capture network connections/traffic for determining browser/SSL versions?
Note that I posted this Q to the StackExchange InfoSec site, but its not as populated as ServerFault and this is more on the technical side of network collection for web services.
I've started ...
2
votes
0
answers
156
views
Long latency to reply a TCP ACK
k8s environment(4 nodes, rke 1.21.5)
We noticed there is randomly significant latency in socket data transferring between different k8s pods. Latency could be as long as 15 seconds in some cases.
By ...
2
votes
0
answers
4k
views
How to figure out what is bad about a 400 bad request, on an Apache-server
The overarching question
How do I see what is 'bad' about a 400 - bad request?
Info about the error
When I click around the WordPress-backend, then between 3 and 7 requests (out of 95-100) give me a:...
2
votes
0
answers
2k
views
tcpdump: invalid cksum from client to localhost interface even after disabling offloading
I'm having a strange issue.
In linux I have two windows open. one running tcpdump and one running curl. I used curl to try to make a connection to local host and tcpdump logs invalid checksum errors. ...
2
votes
1
answer
2k
views
Analyzing traffic by tcpdump between HAProxy server and mariadb
I was testing tcpdump too see the traffic between HAProxy server and mariadb server. These are the results:
23:07:22.328958 00:0c:29:a9:28:a8 > 00:50:56:b0:e0:ea, ethertype IPv4 (0x0800), length ...
2
votes
0
answers
9k
views
Why TCP Out-Of-Order packet is seen after SYN?
I am trying to troubleshoot a performance issue between a client and a file server. When I look at the capture from the client, I see a weird behavior. I am trying to understand this weird behavior.
...
2
votes
0
answers
718
views
Tap interface is not receiving packets
I'm configuring a tap interface and trying to send and receive packets through it, i configure it like this:
ip tuntap add name tap0 mode tap multi_queue
ip link set tap0 up
i'm using scapy to send ...
2
votes
0
answers
3k
views
How to measure latency using wireshark
I'm trying to measure the wire-to-wire latency of a blackbox application. The application engages in tcp offloading (kernel bypass), it consumes incoming UDP packets via a NIC and in response, ...
2
votes
0
answers
645
views
Xen networking - dom0 receives ARP requests but no reachability
Both dom0 and domU are Debian 8.
Dom0 network configuration is:
auto xenbr0
iface xenbr0 inet manual
bridge_ports eth1
bridge_stp off
bridge_waitport 0
bridge_fd 0
auto xenbr0.4
...
2
votes
1
answer
137
views
Network interface reading traffic from 2 different hosts
Situation: Server A is receiving network traffic sent from server B to server C.
Server B & C send over MySQL dumps. Quite some traffic. For some reason the interface on server A is measuring this ...
2
votes
0
answers
2k
views
How to know the source of certain TCP traffic on AIX
We have two AIX boxes, one for production system and another for testing.
both systems are running ATM machine switches, where the ATM device is connected via TCP socket.
we had an issue on ...
1
vote
1
answer
169
views
IPv6 port scanners hang after scanning a closed port
I am testing nftables firewall rules using two virtual machines, one with the active firewall and one that tries to connect to it.
For example with netcat and no firewall:
nc -6 fe80::9d08:b3e2:47fa:...
1
vote
0
answers
315
views
What is the key file for ssldump?
I search google for a tool to decode https traffic and get the ssldump with examples like:
ssldump -k xxx.pem -i eth0 -d host example.com
I wonder what the key file xxx.pem is. On the server hosting ...
1
vote
0
answers
191
views
Why is TCP doing RTO based retransmits (200ms+ wait) vs other fast-retransmission mechanisms?
(Trying this forum after the question was deemed off-topic for Stack Overflow & Network Engineering)
I am investigating an issue where we see occasional 200ms+ spikes in a simple tcp client/server ...
1
vote
0
answers
592
views
dhcp-relay cannot recieve DHCPOFFER packet from DHCP server in shared network
I'm using the dnsmasq service as a DHCP server. I have a bridged interface per node named br0 that has two ip addresses assigned to it. One is the public IP address and the other one is considered the ...
1
vote
0
answers
1k
views
tcpdump: filtering out localhost, packets show up anyway?
I'm trying to use tcpdump to explore what on my computer talks with whom on the world wide web.
I've came this far as of yet:
lan_hosts="(hosts || to || exclude)"
local_hosts="(127.0.0....
1
vote
0
answers
263
views
tcpdump not capturing packets but Apache log shows the request
I'm trying to debug a client side javascript application that sends a XMLHttpRequest to a php script but I don't get any output from tcpdump when this happens. Apache logs the request, the script ...
1
vote
0
answers
57
views
Does tcpdump guarantee packet integrity?
In normal use of tcpdump without any parameter, does it guarantee?
tcpdump -i eth0 -w file.pcap
In using tcpdump rotating by time with -G parameter, does it guarantee?
tcpdump -i eth0 -w file.pcap -...
1
vote
0
answers
43
views
Network packets don't reach local host when connected with to Openstack VPS with Openvpn server
So here is an issue.
I've installed OpenVPN server on Openstack VPS (hostigger, if this is important). I've used guide https://www.digitalocean.com/community/tutorials/how-to-set-up-an-openvpn-server-...
1
vote
0
answers
2k
views
PowerDNS AXFR - ;; communications error to x.x.x.x#53: end of file
Using PowerDNS, we got into an issue with transferring a single domain object (/24) from our primary to our secondary DNS server.
This /24 is part of a larger RIPE block, /22, and is not ...
1
vote
0
answers
268
views
Getting different local-port value in tcpdump when using --local-port option in curl
I'm using curl command to send the traffic to the Server. In curl command, I'm using --local-port option. Below is the command:
curl -v --interface 10.1.1.3 -b --local-port 10000 http://30.1.1.101/...
1
vote
0
answers
31
views
No packet crossing default gateway
I have two Ubuntu 17.04 nodes, A (10.0.9.2) and B (10.0.9.1).
I have set B as default gateway of A, using the command:
route add default gw 10.0.9.1 interface vi4.
Yet, when I traceroute 8.8.8.8 ...
1
vote
0
answers
224
views
Wifi interface drops all packets
I have a remote system connected via WiFi to the network. The wifi connection is established correctly and I can ping the gateway. The maintainer of the gateway (3rd party, not accessible for me) ...
1
vote
1
answer
578
views
tcpdump - how to track the source of requests made with ephemeral/dynamic ports
I'm trying to identify the network traffic between multiple backend microservices running on the same server. (they make some rest http calls to each other)
Unfortunately, when i use tcpdump, the ...
1
vote
0
answers
588
views
Suddenly cannot ssh into any machine
Suddenly I was not able to ssh to any machine. I thought it to be my router/network issue & I tried it with different network but the result was same. I took tcp dump on both server & client ...
1
vote
1
answer
2k
views
tcpdump cannot capture none-broadcast/multicast packets from bridge interface in OpenWRT
(Originally, I posted it on StackOverflow. I move it to networkengineering and then here.)
I have TP-LINK WR841N v9 router and install OpenWRT firmware CHAOS CALMER (15.05.1, r48532).
I have /etc/...
1
vote
0
answers
1k
views
How to capture http requests headers and body
need to capture all incoming/outcoming http traffic of a unix machine, and then run a script on each http header/body.
I have found that tcpdump captures all the requests, but big ones end up being ...
1
vote
0
answers
57
views
VPS instance outbound traffic increasing linearly
I have a DigitalOcean VPS instance whose outbound traffic is behaving strangely, increasing linearly over a 7 day period.
I'm trying to figure out what is going on through tcpdump, but to tell the ...
1
vote
0
answers
517
views
Dump a tcp stream (tcpdump/tpick?) and save to file only if RST happen
I'm looking for a way to capture a whole tcp stream, but save it into the file only if
1) error happens (like RST)
2) not sure if possible - analyze the http response, store if HTTP 500 happen is a ...
1
vote
0
answers
719
views
Duplicate SYN package forwarded by Docker?
I'm experiencing a strange interaction between a CISCO firewall and my Docker host connected to it: the CISCO periodically marks my host as a SYN attacker and shuts my ethernet port down.
I've been ...
1
vote
0
answers
369
views
Server socket sitting in FIN_WAIT_1 whilst network doesn't see its traffic
We've been trying to get a grip on a really weird problem where we can wget a page from Apache 2.2.19 on solaris 10 and some permutations of requests reliably take various fixed lengths of time to ...
1
vote
0
answers
501
views
Wireshark RST against TCP Zero Window
During application sharing with Microsoft Lync Client (Mac OS X), TCP ACK with RST flag is sent from my application end to Lync end against TCP Zero Window packets and call gets dropped.
Image Link.
...
1
vote
0
answers
231
views
Unusual Behavior with NIC Interrupt Moderation Disabled
OS: Centos7
I disabled interrupt moderation,
ethtool -C eno2 rx-usecs 0,
and then started capturing on that interface using tcpdump. The dump file was growing as expected.
Maybe an hour later the ...
1
vote
1
answer
2k
views
server is not responding on SYN packets
On the attached tcp dump, the first two SYN packets (#21800 and 21801) came to the server, however SYN ACK was sent for the second SYN. Is that correct behaviour? My understanding is that the client ...
1
vote
0
answers
127
views
An already acknowledged data sequence number is coming back as null byte repeatedly
There is a transaction processing server (TP-Server) to which my application (Client) connects to. We are seeing a strange packet sequence where in the TP-Server is sending a PUSH packet with a null (...
1
vote
0
answers
3k
views
Use tcpdump to find interface errors
I looking for what's causing dropped packets on an interface:
RX packets:9064457 errors:0 dropped:4736 overruns:0 frame:0
TX packets:6388938 errors:0 dropped:0 overruns:0 carrier:0
I ...
1
vote
0
answers
849
views
Massively large number of packets dropped by interface
I have a virtual machine on ESXi 5 acting as a firewall for a PBX, it is running vyatta. When I run tcpdump on any interface, I get some ridiculous numbers! e.g.
4 packets captured
402 packets ...
1
vote
0
answers
619
views
tcpdump expression to show zero-byte ACKs?
I want to show zero-byte TCP keepalives sent and received. While this could be generally useful, in this particular case I want to prove that a change I made to the JDBC driver (adding tcpKeepAlive=...
1
vote
2
answers
324
views
Server sending packets every 5 minutes to 3 IPs
Been noticing in our firewall logs that three connections are being constantly established every 5 minutes from our web server and trying to send a packet to destination port 43 (whois port) cycling ...
1
vote
0
answers
372
views
Capturing on loopback device on Ubuntu LTS: 15 Mbit of traffic and "x dropped packets"
I am trying to capture about 15 Mbit of traffic on the loopback device on Ubuntu LTS using tcpdump, and I am seeing dropped packets.
The CPU is a freaking i7, and i have yet to see CPU usage go above ...
1
vote
1
answer
2k
views
How can I dump nginx requests for a specific location while nginx is secured?
I want to dump all request that nginx is getting for a specific location so I can debug a strange problem that I have.
Usually tcpdump would be the solution but remember that nginx is accessed using ...
1
vote
0
answers
173
views
tcpdump strange udp line
I've found a strange line in the tcpdump output. Normally UDP packets are dumped in the following form:
timestamp IP srcaddress.port > dstaddress.port: UDP, length packetlength
but this is just:
...
1
vote
1
answer
300
views
TCP stops sending weirdly
In case to find out the cause of TCP retransmits on my Linux (RHEL, kernel 2.6.18) servers connecting to the same switch. I had a client-server pair send "Hello" to each other every 200us and ...
1
vote
1
answer
546
views
tcpdump not giving details
Why does tcpdump not give my more details? Each time it only comes as - 16:22:26.128541 [|ether]
# ./tcpdump -vv not port 22
tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size ...
1
vote
1
answer
1k
views
How to strip TCP headers from tcpdump (with hexadecimal output of non-printable data)
tcpdump don't know how to strip TCP headers from packed data.
tcpflow print's only packet data, nice, but it supports only ASCII characters, no hexadecimal output possible.
Did I overlooked some ...